MozDef: The Mozilla Defense Platform
Clone or download
Latest commit 21ac8f5 Nov 21, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Update Jun 15, 2017
alerts Merge pull request #931 from mozilla/add_hostname_ssh_lateral Nov 19, 2018
benchmarking Resolve E127 continuation line over indented Oct 31, 2018
bot Resolve E128 continuation line under indented Oct 31, 2018
cloudy_mozdef fix syntax error Nov 21, 2018
config Merge remote-tracking branch 'origin/infosec_workweek' into virtualen… Oct 24, 2018
cron pep8 everything Nov 15, 2018
docker ensure mozdef always polls the SQS queue we create Nov 21, 2018
docs rm mailing list Nov 13, 2018
examples add more login sample data Nov 12, 2018
loginput Resolve E302 expected 2 blank lines found 1 Oct 30, 2018
meteor reset the cursor on error Nov 12, 2018
mozdef_util correct the license Nov 21, 2018
mq fix flake 8 error Nov 21, 2018
rest properly init the config Nov 13, 2018
static Remove heatmap html page Jun 15, 2017
systemdfiles Update python virtualenv path for service files Apr 20, 2018
tests Merge pull request #931 from mozilla/add_hostname_ssh_lateral Nov 19, 2018
.flake8 Resolve E122 continuation line missing indentation or outdented Oct 31, 2018
.gitignore add feature removal docs, update gitignore Nov 6, 2018
.travis.yml upgrade travis docker-compose as per… Oct 30, 2018 Modifying urls to point to mozilla from jeffbryner, slight readabilit… Jun 15, 2017
LICENSE Updated license file to conform with MPL Feb 25, 2014
Makefile Add new make target to run only resources for tests Nov 14, 2018 Update documentation header in readme Oct 25, 2018
requirements.txt Increase configlib version requirement Nov 1, 2018

Build Status Documentation Status

MozDef: The Mozilla Defense Platform


The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

The Mozilla Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.


  • Provide a platform for use by defenders to rapidly discover and respond to security incidents.
  • Automate interfaces to other systems like bunker, cymon, mig
  • Provide metrics for security events and incidents
  • Facilitate real-time collaboration amongst incident handlers
  • Facilitate repeatable, predictable processes for incident handling
  • Go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation


MozDef is in production at Mozilla where we are using it to process over 300 million events per day.